---
title: "Assess a suspected data breach of patient information and decide whether to notify"
url: "https://ailawframework.com/practice/health-and-medical-law/assess-a-suspected-data-breach-of-patient-information-and-decide-whether"
type: "task"
site: "AI Law Framework"
id: "A32-R20261018-4"
practice_area: "Health & Medical Law"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Assess a suspected data breach of patient information and decide whether to notify

> From the incident report, the systems affected and the data involved, record the date the practice became aware, calculate the 30-day assessment deadline, list the kinds of health and personal information involved and…

Canonical page: https://ailawframework.com/practice/health-and-medical-law/assess-a-suspected-data-breach-of-patient-information-and-decide-whether  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Health & Medical Law](https://ailawframework.com/practice/health-and-medical-law.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the incident report, the systems affected and the data involved, record the date the practice became aware, calculate the 30-day assessment deadline, list the kinds of health and personal information involved and the individuals affected, and set out the facts relevant to serious harm and to any remedial action taken. |
| What the lawyer must review | The lawyer decides whether the breach is likely to result in serious harm, whether remedial action prevented that, whether and how to notify individuals and the Commissioner, and settles the statement and notices. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Source-by-source verification**

Trace relied-on content to independent sources and check for relevant material the output has missed.

- What the AI does: From the incident report, the systems affected and the data involved, record the date the practice became aware, calculate the 30-day assessment deadline, list the kinds of health and personal information involved and the individuals affected, and set out the facts relevant to serious harm and to any remedial action taken.
- What the lawyer does: The lawyer decides whether the breach is likely to result in serious harm, whether remedial action prevented that, whether and how to notify individuals and the Commissioner, and settles the statement and notices.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Confirm patient health information goes only into a tool the practice has approved for health records, de-identified where the task allows, and that the output discloses no patient detail beyond what the recipient needs.
2. Confirm the awareness date from the incident record.
3. Check the list of information types against the affected systems, not assumptions.
4. Record the serious-harm reasoning before any decision not to notify.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [OAIC, Data breach preparation and response, Part 4: Notifiable Data Breach (NDB) scheme](https://www.oaic.gov.au/privacy/notifiable-data-breaches/preventing-preparing-for-and-responding-to-data-breaches/data-breach-preparation-and-response/part-4-notifiable-data-breach-ndb-scheme) (checked 2026-10-18)

## Forms and precedents for this task

| Form or precedent | Kind | AI level | Summary |
| --- | --- | --- | --- |
| [Eligible data breach assessment record](https://ailawframework.com/precedents/health-and-medical-law/eligible-data-breach-assessment.md) | Form | Red | Record for deciding whether a loss of, or unauthorised access to, personal information is an eligible data breach that must be notified. The officer makes the decision. |
| [HIPAA use and disclosure limits checklist](https://ailawframework.com/precedents/health-and-medical-law/us-phi-use-limits.md) | Checklist | Yellow | Checklist of the use and disclosure limits in 45 CFR 164.502 that a reviewer applies to a business associate contract and a privacy notice. It does not authorise a use. |

Signed-in accounts can read the full text of each one.

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/practice/health-and-medical-law/assess-a-suspected-data-breach-of-patient-information-and-decide-whether/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*